CVE-2018-20816

Опубликовано: 05 апр. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

Ссылки

https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11
Release Notes
Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24
Release Notes
Vendor Advisory
https://github.com/salesagility/SuiteDocs/pull/198/files
Patch
Third Party Advisory
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_11
Release Notes
Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_24
Release Notes
Vendor Advisory
https://github.com/salesagility/SuiteDocs/pull/198/files
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.8.24 (исключая)

cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*

Версия от 7.10.00 (включая) до 7.10.11 (исключая)

EPSS

Процентиль: 36%

0.00153

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-m8mc-2q3x-mw37